Impacket lookupsid.py

Back to the Category Index / Back to the Command Index

Overview

Queries LSA for SIDs formed from successive RIDs to enumerate the domain SID and associated account names.

Item	Details
Implementation	examples/lookupsid.py
Category	Active Directory / LDAP / Account Management
Size	204 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/lookupsid.py -h for the current option definitions.

Argument	Description
target	[[domain/]username[:password]@]<targetName or address>
maxRid	Maximum RID to check (default: 4000).
-debug	Enable debug logging.
-ts	Add timestamps to log output.
-target-ip	Target machine IP address. Defaults to target; useful when the target is a NetBIOS name that cannot be resolved.
-port	Destination SMB server port (choices: 139, 445; default: 445).
-domain-sids	Enumerate domain SIDs (likely forwarding requests to the DC).
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Skip the password prompt (useful when proxying through smbrelayx).
-k	Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid.

Detailed Processing Flow

The command binds to LSARPC over an SMB named pipe and obtains the domain SID from policy information. It appends RIDs to that SID and repeats lookups, displaying resolved SIDs, types, and names. -domain-sids focuses on reporting discovered domain SIDs.

How It Works

LSA lookup is not an API that returns a list of names. Instead, the command builds candidate SIDs by adding RIDs in sequence to the domain SID and asks the server to resolve them. It first obtains the account domain SID from a policy handle, then sends batches of S-1-5-...-RID values to LsarLookupSids to discover users, groups, and aliases.

Many RIDs do not exist, so STATUS_NONE_MAPPED and STATUS_SOME_NOT_MAPPED are normal responses during enumeration. Even when only some SIDs in a batch resolve, the translated-name array must be matched correctly to domain-list indexes. Ending on every exception would stop the search at the first gap in the RID range.

The result is not a complete list of directory objects. Deleted RIDs, lookup permissions, the RID limit, and other domain SIDs affect what appears. -domain-sids focuses on collecting discovered domain information, but the output must distinguish guessed SIDs from domain names returned by the server.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
LSALookupSid	36	__init__(), dump()

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket.examples	logger
impacket.examples.utils	parse_target
impacket	version
impacket.dcerpc.v5	lsad, lsat, transport
impacket.dcerpc.v5.samr	SID_NAME_USE
impacket.dcerpc.v5.dtypes	MAXIMUM_ALLOWED
impacket.dcerpc.v5.rpcrt	DCERPCException

Output, Side Effects, and Required Privileges

• Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command uses dcerpc.v5.transport / lsad / lsat and the shared target parser. LSALookupSid.dump() handles connection and enumeration, and must treat STATUS_SOME_NOT_MAPPED as a normal search result.

Verification

• Syntax: python -m py_compile examples/lookupsid.py
• CLI: python examples/lookupsid.py -h
• Related test: tests/SMB_RPC/test_rpcrt.py
• Related test: tests/dcerpc/test_samr.py
• Related test: tests/misc/test_dcerpc_v5_ndr.py